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REMARKS 

STATUS OF THE CLAIMS 

Claims 1-57 were pending in this application. Claims 11, 13-20, 24-42, 46, 47, and 54-57 
have been withdrawn. Claims 1-4, 10, 12, 21, 22, 48, 49, and 53 have been amended. 
Following entry of the amendments claims 1-10, 12, 21-23, 43-45, and 48-53 will be pending and 
at issue. 

ALLOWABLE SUBJECT MATTER 

Applicant acknowledges the Examiner's statement that claims 43-45 would be allowable 
if rewritten to overcome the rejections under 35 USC 101 and to include all of the limitations of 
the base claim and any intervening claims. Office Action, p. 1 1 . 

ELECTION/RESTRICTION REQUIREMENT 

Pursuant to the restriction requirement made final and election with traverse of claims 1- 
10, 12, 21-23, 43-45, and 48-53, Applicant withdraws claims 11, 13-20, 24-42, 46, 47, and 54-57 
with entry of this amendment. Applicant reserves the right to file subsequent applications 
claiming the withdrawn subject matter. In addition, the claim withdrawals should not be 
construed as abandonment or agreement with the Examiner's position in the Office Action. 

AMENDMENTS TO THE SPECIFICATION 

The specification has been amended to delete the embedded hyperlinks noted by the 
Examiner. Office Action, p. 4. Specifically, the hyperlinks on pages 2 and 4 have been deleted. 
The Applicant thanks the Examiner for pointing out this inadvertent error. The Applicant also 
notes that the trademarks used in the application have been capitalized and accompanied by the 
generic terminology where appropriate. 

The specification has also been amended to add in reference numbers 130, 150, 160, 170, 
175, and 180, which the Examiner noted were included in the Figures, but not referred to in the 
text of the specification. These reference numbers are now included in the text of the 
specification. No new matter has been added. 
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AMENDMENTS TO THE DRAWINGS 

The Examiner objected to Figures 1-8 and 17-21, stating that these Figures have lines that 
are "not uniformly thick and well-defined." Office Action, p. 3. Applicant has thus included 
corrected drawing sheets for Figures 1-8 and 17-21, each labeled "Replacement Sheet," in which 
this problem has been corrected. 

In addition, as stated above, the Examiner objected to the drawings because they include 
the following reference characters not mentioned in the description: 130, 150, 160, 170, 175, and 
180. Office Action, p. 3. These reference characters are found in Figures 3, 4, and 5. As 
described above with regard to the Amendments to the Specification, the Applicant has amended 
the specification to add in the reference numbers at the appropriate locations. The Applicant 
thanks the Examiner for pointing out this inadvertent omission. The amended figures are 
included herewith and are each labeled "Replacement Sheet." 

Approval of the Replacement Sheets of drawings is respectfully requested. 

IDS 

Applicant notes with appreciation the Examiner's thorough consideration of the 
references cited in the IDS (Form 1449) submitted on December 6, 2001 . Office Action, pp. 2-3. 
Applicant has also re-submitted the French Patent No, 2693809 in the IDS included herewith. 
This submission includes a concise explanation of the relevance of the non-English information, 
pursuant to MPEP § 609. Applicant respectfully requests that the Examiner now consider this 
French Patent No. 2693809, in light of the new submission. 

CLAIM OBJECTION 

The Examiner objected to claim 49, stating that "[s]ince the execution of the encryption 
algorithm encrypts the code polymorph, the execution of the encryption algorithm cannot be a 
separate, prior event." Office Action, pp. 4-5. Applicant has amended claim 49 to clarify the 
text of the claim. The claim, as amended, states that the "randomly generated encryption 
algorithm is executed prior to application to subsequent layers for providing additional 
encryption of the code polymorph." This amendment is supported by the latter portion of the 
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first full paragraph of page 14, which states that "[b]ecause the cipher algorithm 650 is not 
known at the time of wrapping, the newly created random cipher algorithm 650 must be executed 
in order to correctly determine the result to apply to subsequent layers for providing additional 
encryption of the code segment 640." Applicant respectfully requests that the Examiner 
withdraw this objection to claim 49. 
REJECTIONS UNDER 35 U.S.C. § 101 

Claims 1-5, 7-10, 12, 21-23, 43-45, and 48-53 were rejected under 35 U.S.C. § 101 
because "the claimed invention is directed to non-statutory subject matter." The Examiner stated 
that "[e]ach claim solely teaches to manipulation of abstract data, and is not tangibly embodied." 
Office Action, p. 5. Applicant respectfully disagrees, but to further expedite prosecution, 
Applicant has amended claims 1, 10, 12, 21, 48 and 53 to more clearly recite statutory subject 
matter. 

The Federal Circuit has recognized that § 101 captures a broad scope of computer-related 
inventions. The MPEP also reflects the relevant case law by stating several different ways that 
process claims, such as claims 1, 21, 48, and 53, and system claims, such as claims 10 and 12, 
can be statutory. According to the MPEP §2106 IV.B.2.(b).(ii) s a claimed process that involves 
an abstract idea must be limited to a practical application of that idea in the technological arts. 
See MPEP §2106 IV.B.2.(b).(ii); see also In re Alappat, 33 F.3d 1526, 1543 (Fed. Cir. 1994) 
(quoting Diamond v. Diehr, 450 U.S. 175, 192 (1981)); see also Alappat, 33 F.3d at 1569 
(stating that "unpatentability of the principle does not defeat patentability of its practical 
application"). The MPEP clarifies that a claim is "limited to a practical application when the 
method, as claimed, produces a concrete, tangible, and useful result; i.e., the method recites a 
step or act of producing something that is concrete, tangible and useful." See MPEP §2106 
IV.B.2.(b).(ii); see also AT&T Corp. v. Excel Communications Inc., 172 F.3d 1352, 1358 (Fed. 
Cir. 1999). Similarly, a machine or system claim is statutory when the machine "produces a 
concrete, tangible and useful result." See MPEP §2106 IV.B.2.(b).(ii); see also State Street Bank 
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& Trust v. Signature Financial Group,_149 F.3d 1368, 1373 (Fed. Cir. 1998). Thus, as the 
MPEP explains, a claimed computer process that uses an abstract idea or a mathematical 
algorithm to do something (rather than just calculating an algorithm without describing a use) is 
statutory. See MPEP §2106 IV.B.2.(b).(ii). . 

Applicant respectfully submits that process claims 1, 21, 48, and 53, as amended, are 
statutory under MPEP provisions and case law described above. These claims each recite 
"modifying compiled code of an application program for executing on a computer to improve 
computer security while substantially preserving the application's original operational and 
functional characteristics." These claims thus recite a specific process being conducted (e.g., the 
modification of compiled code) that is conducted on a specific entity (e.g., an application 
program), which can be executed on a computer. The practical application is to improve 
computer security while still substantially preserving the application program's original 
operational and functional characteristics. The claims do not describe a process that "merely 
manipulates an abstract idea or performs a purely mathematical algorithm." See MPEP §2106 
IV.B.2.(b).(ii). Instead, the claimed process is limited to a practical computerized method that 
has a concrete, tangible and useful result. As described in the specification, the invention relates 
to "a system and method for improving security features of executable computer program code 
and/or data which is generated, stored or manipulated by program code in order to more 
effectively prevent theft, decompilation, unauthorized reproduction, and/or unauthorized use." 
See Specification at Field of the Invention, p. 2. Thus, claims 1, 21, 48, and 53 simply set forth 
arid claim this concrete and practical application described throughout the specification for 
improving security features (e.g., to prevent theft, decompilation, reproduction, etc.) of a 
program by modifying the compiled code of a program while still maintaining the program's 
operational/functional characteristics. 

Similarly, Applicant respectfully submits that system claims 10 and 12, as amended, are 
statutory under MPEP provisions and case law described above. These claims both recite a 
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"system for modifying the compiled code of an application program for execution on a computer 
to improve computer security while substantially preserving the application's original operational 
and functional characteristics." As stated above, a machine or system claim is statutory when the 
machine "produces a concrete, tangible and useful result." See MPEP §2106 IV.B.2.(b).(ii); see 
also State Street Bank & Trust v. Signature Financial Group,_149 R3d 1368, 1373 (Fed. Cir. 
1998). As described above, the system has the practical and concrete application of improving 
computer security (e.g., improving security features of a program or data associated with a 
program) by modifying compiled code of a program while still preserving the program's original 
operation and function. Thus, Applicant respectfully requests withdrawal of this rejection. 

REJECTIONS UNDER 35 U.S.C. § 112, FIRST PARAGRAPH 

Claim 23 was rejected under 35 U.S.C. § 112, first paragraph as allegedly containing 
subject matter which was not described in the specification in such a way as to enable one skilled 
in the art to which it pertains, or with which it is most nearly connected, to make and/or use the 
invention. Office Action, p. 5. Examiner stated that Applicant's specification "merely refers to 
several methods for several recovery methods that are not well-known in the art (symmetric 
correlation, asymmetric correlation, etc.) without describing the methods." Applicant 
respectfully disagrees. Applicant notes that each of these methods is referred to in the 
specification in the last paragraph of page 15. In addition, these methods are all known in the art 
and one of ordinary skill in the art would further understand the meaning of claim 23 based on 
the description provided in the specification. For example, a look-up table is generally known to 
one of ordinary skill in the art. In addition, the look-up table is further described in the following 
sections of the specification: the last paragraph of page 10 that continues into page 1 1, the 
second to last paragraph on page 16, the text on page 17 associated with Fig. 13 and Fig. 13 
itself, which depicts a look-up table, etc. As another example, the concept of a database query is 
very well-known in the art and is also described in the specification at the top of page 23. 
Similarly, functional correlation is well-known and is described in the last paragraph of page 12. 
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In addition, other types of correlation are known in the art, such as parametric correlation, 
symmetric correlation, asymmetric correlation, etc., and explanations of correlation are provided 
in the specification at the end of the first full paragraph on page 14, the last paragraph of page 1 5, 
etc. Thus, Applicants respectfully request withdrawal of this ground of rejection. 

REJECTIONS UNDER 35 U.S.C. § 112, SECOND PARAGRAPH 

Claim 3 was rejected under 35 U.S.C. § 112, second paragraph as allegedly indefinite 
because there is insufficient antecedent basis for the limitation, "the polymorph produced in the 
preceding iteration." Office Action, p. 6. Claim 3 has been amended to correct this inadvertent 
error. 

Claims 2-4 and 22 were rejected under 35 U.S.C. § 1 12, second paragraph as allegedly 
indefinite because they are "incomplete for omitting essential structural cooperative relationships 
of elements, such omission amounting to a gap between the necessary structural connections." 
Office Action, p. 6. Claims 2-4 and 22 have been amended to correct this inadvertent error and 
to clarify the structural cooperative relationships of elements. 

Applicants have corrected these inadvertent errors and thus request withdrawal of this 
rejection as drawn to the amended claims. These amendments of the claims are made so as to 
more clearly define the invention, and not to narrow their scope of protection with respect to the 
prior art, or with respect to potentially infringing devices/compositions/articles. 

REJECTIONS UNDER 35 U.S.C. § 102 

Claims 1-4, 6-10, 12, and 21-23 are rejected under 35 U.S.C. § 102(b) as allegedly being 
unpatentable over WIPO Patent Publication No. 99/01815 to Colberg et al. Applicant traverses 
this ground of rejection. 

In order for a reference to anticipate an invention, the reference must teach each and every 
element of the claimed invention. The Examiner pointed to a description, in Colberg (p. 53, line 
21 to p. 55, line 16), of an ordering transformation or a technique of obfuscating code in which 
the placement of any item in the source application is randomized. See Colberg, p. 54, Ins. 3-5. 
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However, this is different from the methods recited in claims 1 and 10. Claims 1 and 10 recite a 
step of "scanning said compiled code for candidate instructions for substitution," and a step of 
"substituting randomly generated, functionally isomorphic code in place of said candidate 
instructions." The section of Colberg cited by the Examiner only discloses a technique of 
reordering the placement of items in the source application, but does not describe a step of 
scanning compiled code to find candidate instructions and then substituting the candidate 
instructions for randomly generated, functionally isomorphic code. The randomization in 
Colberg applies to randomizing of placement rather than the random generation of functionally 
isomorphic code described in the present application, which is substituted in for the candidate 
instructions. Similarly, the second section of Colberg cited by the Examiner (p. 68, line 14 to p. 
69, line 9) only discloses randomization of the order of computations to be performed in 
obfuscation or randomizing the order of declarations used in the source application. 

In addition, the sections of Colberg cited by the Examiner do not describe the element of 
"substituting... wherein the randomly generated, functionally isomorphic code is generated by 
random selection from a plurality of candidate codes that are substantially functionally 
isomorphic to the compiled code," recited in amended claims 1 and 10, The specification of the 
present application states as follows: 

A random polymorphic engine 15 scans the code (step 115) of the compiled executable 
10 to look for predetermined candidate instructions to be replaced with random 
functionally isomorphic instructions. In one exemplary embodiment, this may be 
accomplished by randomly selecting an entry in an instruction look-up table. Such a look- 
up table might comprise, for example, four different options for accomplishing the result 
of adding two numbers together using the instruction set of a particular CPU. Fig. 10 
depicts a set of exemplary candidate instructions in accordance with, for example, a 
representative subset of INTEL® instruction codes which lend themselves to substitution 
with multiple functionally isomorphic replacement options. 

Specification at p. 11. The section cited in Colberg does not disclose any random selection from 
a plurality of candidate functionally isomorphic codes (e.g., in a look-up table), but only 
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describes an ordering transformation in which the placement of any item in the source application 
is randomized. 

Regarding independent claims 12 and 21, the Examiner stated that "compiled code 
comprises original CPU instructions," but provided no further explanation of how the specific 
elements recited in these claims are disclosed in Colberg. Office Action at p. 8. The sections of 
Colberg cited by the Examiner do not disclose "substituting random context instruction codes for 
original CPU instructions in said compiled code." As the specification for the present invention 
explains, the polymorphic engine generates virtual CPU opcodes that represent nonsensical, 
random context instructions, and the original opcodes are replaced by these random context 
instructions. See Specification at last paragraph of p. 15. In addition, the sections cited in 
Colberg do not disclose "correlating said random context instruction codes to said original CPU 
instructions in order to recover said original CPU instructions," and in fact, Colberg does not 
refer at all to any correlation techniques. As the specification for the present invention explains, 
a matchable data structure that is randomly created when the polymorphed application initializes 
correlates instructions specific to the CPU's instruction set with virtual CPU opcodes generated 
by the polymorphic engine (nonsensical random context instructions). Thus, it is possible to 
recover the original CPU instructions based on this correlation. Specification at last paragraph of 
p. 15. Colberg does not disclose any such correlation of instructions, nor does Colberg disclose 
any recovery of original CPU instructions at the cited sections. 

Accordingly, Applicant respectfully submits that Colberg fails to teach each and every 
element of claims 1, 10, 12, and 21, and thus Colberg cannot anticipate the inventions recited by 
these claims. Since claims 2-4, 6-9, 22, and 23 depend from and incorporate all of the elements 
of the independent claims, claims 2-4, 6-9, 22, and 23 also cannot be anticipated by Colberg. 

Claims 1 and 5 are rejected under 35 U.S.C. § 102(b) as allegedly being unpatentable 
over U.S. Patent No. 5,696,822 to Nachenberg. Applicant traverses this ground of rejection. 
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As stated above, in order for a reference to anticipate an invention, the reference must 
teach each and every element of the claimed invention. The Examiner pointed to a brief 
description in Nachenberg (col. 1, lines 1 1-17) of polymorphic viruses and generally how they 
work. Office Action at p. 8. However, the Examiner has not shown how Nachenberg includes 
all of the elements of the claim. For example, the section that the Examiner pointed to in 
Nachenberg does not describe the step of "scanning said compiled code for substitution." 
Nachenberg simply refers to a mutation engine that "generates a virus decryption routine" and 
then "uses the dual of this routine to encrypt the static virus body and the mutation engine." 
There is no explanation of how this encryption occurs. There are various mechanisms by which 
the polymorphic virus might work to generate the virus decryption routine, and thus one cannot 
assume that there would be any step involving scanning compiled code for specific candidate 
instructions to be substituted. Similarly, Nachenberg does not describe a step of substituting code 
in place of the candidate instructions for which the scanning was performed. Nachenberg only 
vaguely refers to some mutation strategies, but does not actually describe the specific substitution 
step, as recited in claim 1, where randomly generated, functionally isomorphic code is substituted 
in place of the candidate instructions to generate a first code polymorph. In addition, the sections 
of Nachenberg cited by the Examiner do not describe the element of "substituting. . .wherein the 
randomly generated, functionally isomorphic code is generated by random selection from a 
plurality of candidate codes that are substantially functionally isomorphic to the compiled code," 
recited in amended claim 1 . 

Accordingly, Applicant respectfully submits that Nachenberg fails to teach each and 
every element of claim 1 , and thus Nachenberg cannot anticipate the invention recited by claim 1 . 
Since claim 5 depends from and incorporates all of the elements of claim 1, claim 5 also cannot 
be anticipated by Nachenberg. 

Therefore, Applicant submits that the references cited herein do not anticipate the claims, 
and Applicant respectfully requests that this ground of rejection be withdrawn. 
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REJECTIONS UNDER 35 U.S.C § 103 

. Claims 48, 49, and 51-53 are rejected under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over U.S. Patent No. 6,066,328 to Drake in view of U.S. Patent No. 6,236,728 to 
Marchant Applicant traverses this ground of rejection. 

Three requirements must be met for a prima facie case of obviousness. First, the prior art 
references must teach all the limitations of the claims. Second, there must be a motivation to 
modify the reference or combine the teachings to produce the claimed invention. Third, a 
reasonable expectation of success is required. 

The cited prior art references do not teach all of the elements of the claims. The 
Examiner stated that Drake discloses "insertion of obfuscating code, which is isomorphic, in 
appropriate places," and the Examiner noted that "[s]canning the code is necessary to determine 
such places." Office Action at p. 9. However, Drake does not disclose the element of 
"substituting randomly generated, functionally isomorphic code in place of said candidate 
instructions," recited in independent claims 48 and 53. The section of Drake cited by the 
Examiner describes usage of "obfuscating inserts" and states that "[ojbfuscation is achieved by 
following unconditional jump instructions. . .with one or more dummy op-code bytes which will 
cause subsequent op-codes to be erroneously disassembled." Drake at col. 5, Ins. 42-54. Drake 
does not disclose substitution of candidate instructions for randomly generated, functionally 
isomorphic code. The section in Drake cited by the Examiner does not refer to any random 
generation of code. Furthermore, Drake does not disclose "substituting. . .wherein the randomly 
generated, functionally isomorphic code is generated by random selection from a plurality of 
candidate codes that are substantially functionally isomorphic to the compiled code," recited in 
amended claims 48 and 53. 

Marchant fails to remedy the deficiencies of Drake. Marchant focuses on a portable 
security apparatus and does not describe any scanning step or any substitution step, as recited in 
claims 48 and 53. Accordingly, the combination of Drake and Marchant does not include all of 
the element of claims 48 and 53, and thus the combination cannot render the claims obvious. In 
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addition, claims 49, 51, and 52 are dependent claims that incorporate all of the elements of the 
independent claims from which they depend, so these dependent claims cannot be rendered 
obvious either. 

The cited art does not teach or provide a motivation to combine the teachings. The 
Examiner stated that it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the invention of Drake by using random encryption algorithms on 
a per-security unit basis, as disclosed by Marchant, as this gives higher security. However, there 
is no suggestion in Drake that higher security through use of random encryption techniques 
would be desirable to supplement the methods already disclosed in Drake, and Drake does not 
state any need for modification or improvement of the described encryption techniques. The 
Examiner must show "reasons that the skilled artisan, confronted with the same problem as the 
inventor, and with no knowledge of the claimed invention, would select the elements from the 
cited prior art reference for combination in the manner claimed." In re Rouffet, 47 USPQ2d at 
1458, 1453 (Fed. Cir. 1998). Thus, the motivation to combine must be particularized, and the 
required evidence cannot be substituted with a generalized scientific goal. 

Accordingly, the cited art does not teach or provide a motivation to combine the 
teachings, and thus the cited art cannot render obvious claims 48, 49, and 51-53. 

Claim 50 is rejected under 35 U.S.C. § 103(a) as allegedly being unpatentable over U.S. 
Patent No. 6,066,328 to Drake in view of U.S. Patent No. 6,236,728 to Marchant as applied to 
claim 48 further in view of U.S. Patent No. 5,966,450 to Hosford et al. Applicant traverses this 
ground of rejection. Claim 50 depends from claim 48 and incorporates all of the elements of 
claim 48. Thus, claim 50 cannot be rendered obvious by the cited combination at least for the 
reasons described above regarding why claim 48 is not rendered obvious by Drake in view of 
Marchant. Hosford does not remedy the deficiencies of Drake and Marchant. 

In conclusion, the cited references do not disclose all the limitations of the claims, and 
there is no motivation to combine the references as suggested by the Examiner. Accordingly, a 
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prima facie case of obviousness has not been presented by the Office. Therefore, withdrawal of 
this ground of rejection of claims 48, 49, 50, and 51-53 is respectfully requested. 
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CONCLUSION 

Withdrawal of the pending rejections and reconsideration of the claims are respectfully 
requested, and a notice of allowance is earnestly solicited. If the Examiner has any questions 
concerning this Response, the Examiner is invited to telephone Applicant's representative at 
(650)335-7185. 

Respectfully submitted, 
DAVID TUCKER, ET AL. 



Dated: 




Antonia L. Sequeira, Esq. 
Reg. No.: 54,670 
Fenwick & West LLP 
Silicon Valley Center 
801 California Street 
Mountain View, CA 94041 
Tel.: (650)335-7185 
Fax.: (650) 938-5200 
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AMENDMENTS TO THE DRAWINGS 

Please replace Figures 1-8 and 17-21 with the replacement figures 1-8 and 17-21, 
included herewith and each labeled "Replacement Sheet." 
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